GHSA-GWFQ-86J8-7QHV rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the run function. An attacker can obtain sensitive internal information, such as file paths, Go module versions, goroutine states, memory addresses, and partial file contents by triggering a panic in the RC API a...

PT-2026-81366

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description The RC API includes full Go stack traces in error responses when panics occur. This allows attackers to trigger panics to leak sensitive information, including internal file paths, module versions,...

PT-2026-75971

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...